@evolith/core-domain 1.0.0 → 1.0.1

package/rulesets/topologies/agentic-ai/agentic-ai.test.rego

@@ -0,0 +1,68 @@
+package evolith.topologies.agentic_ai_test
+
+import data.evolith.topologies.agentic_ai
+
+compliant_input := {"satellite": {"agenticAi": {
+  "hasIdentity": true,
+  "hasIsolatedSandbox": true,
+  "hasSeparatedPromptAndImplementation": true,
+  "requiresApprovalForMutativeTools": true,
+  "hasEphemeralSandboxLimits": true,
+  "hasTrustedContextPolicy": true,
+  "hasAccountableActions": true,
+  "hasOperationalBudgets": true,
+  "hasCredentialLifecycle": true,
+}}}
+
+test_compliant_agent_has_no_violations {
+  violations := agentic_ai.violations with input as compliant_input
+  count(violations) == 0
+}
+
+test_missing_identity_is_rejected {
+  i := json.patch(compliant_input, [{"op": "replace", "path": "/satellite/agenticAi/hasIdentity", "value": false}])
+  violations := agentic_ai.violations with input as i
+  violations[_].id == "AAI-R01"
+}
+
+test_missing_operational_budgets_is_rejected {
+  i := json.patch(compliant_input, [{"op": "replace", "path": "/satellite/agenticAi/hasOperationalBudgets", "value": false}])
+  violations := agentic_ai.violations with input as i
+  violations[_].id == "AAI-R08"
+}
+
+test_missing_credential_lifecycle_is_rejected {
+  i := json.patch(compliant_input, [{"op": "replace", "path": "/satellite/agenticAi/hasCredentialLifecycle", "value": false}])
+  violations := agentic_ai.violations with input as i
+  violations[_].id == "AAI-R09"
+}
+
+test_missing_isolated_sandbox_is_rejected {
+  i := json.patch(compliant_input, [{"op": "replace", "path": "/satellite/agenticAi/hasIsolatedSandbox", "value": false}])
+  violations := agentic_ai.violations with input as i
+  violations[_].id == "AAI-R02"
+}
+
+test_missing_prompt_separation_is_rejected {
+  i := json.patch(compliant_input, [{"op": "replace", "path": "/satellite/agenticAi/hasSeparatedPromptAndImplementation", "value": false}])
+  violations := agentic_ai.violations with input as i
+  violations[_].id == "AAI-R03"
+}
+
+test_missing_mutative_approval_is_rejected {
+  i := json.patch(compliant_input, [{"op": "replace", "path": "/satellite/agenticAi/requiresApprovalForMutativeTools", "value": false}])
+  violations := agentic_ai.violations with input as i
+  violations[_].id == "AAI-R04"
+}
+
+test_missing_ephemeral_limits_is_rejected {
+  i := json.patch(compliant_input, [{"op": "replace", "path": "/satellite/agenticAi/hasEphemeralSandboxLimits", "value": false}])
+  violations := agentic_ai.violations with input as i
+  violations[_].id == "AAI-R05"
+}
+
+test_missing_trusted_context_policy_is_rejected {
+  i := json.patch(compliant_input, [{"op": "replace", "path": "/satellite/agenticAi/hasTrustedContextPolicy", "value": false}])
+  violations := agentic_ai.violations with input as i
+  violations[_].id == "AAI-R06"
+}

package/rulesets/topologies/agentic-ai/cli/cli-flows.es.md

@@ -0,0 +1,35 @@
+# Agentic AI — Flujos CLI
+
+> **Navegación Bilingüe:** [English Version](./cli-flows.md)
+
+**Validadores declarados:** `validate-topology`
+
+## Validate
+
+```bash
+evolith validate --topology agentic-ai
+evolith validate --topology agentic-ai --strict
+evolith validate --topology agentic-ai --format json
+```
+
+## Inspect
+
+```bash
+evolith topology inspect agentic-ai
+evolith topology inspect agentic-ai --include-budgets
+```
+
+## Drift
+
+```bash
+evolith drift detect --topology agentic-ai
+evolith drift detect --topology agentic-ai --format json
+```
+
+## Scaffold
+
+```bash
+evolith architecture scaffold --topology agentic-ai
+evolith architecture scaffold --topology agentic-ai --dry-run
+evolith architecture scaffold --topology agentic-ai --format json
+```

package/rulesets/topologies/agentic-ai/cli/cli-flows.md

@@ -0,0 +1,45 @@
+# Agentic AI — CLI Flows
+
+> **Bilingual Navigation:** [Versión en Español](./cli-flows.es.md)
+
+**Validators declarados:** `validate-topology`
+
+The following CLI commands are available for the Agentic AI topology.
+
+## Validate
+
+```bash
+evolith validate --topology agentic-ai
+evolith validate --topology agentic-ai --strict
+evolith validate --topology agentic-ai --format json
+```
+
+Validates an Agentic AI configuration against the topology's native rules (`agentic-ai.rules.json`) and OPA Rego policies (`agentic-ai.rego`), checking agent isolation, trust boundaries, and action authorization.
+
+## Inspect
+
+```bash
+evolith topology inspect agentic-ai
+evolith topology inspect agentic-ai --include-budgets
+```
+
+Returns the parsed Agentic AI topology manifest, operational budgets (token, credential rotation, sandbox timeout), and corpus artifact references.
+
+## Drift
+
+```bash
+evolith drift detect --topology agentic-ai
+evolith drift detect --topology agentic-ai --format json
+```
+
+Detects configuration drift between the Agentic AI topology's declared ruleset and the current workspace state.
+
+## Scaffold
+
+```bash
+evolith architecture scaffold --topology agentic-ai
+evolith architecture scaffold --topology agentic-ai --dry-run
+evolith architecture scaffold --topology agentic-ai --format json
+```
+
+Scaffolds an Agentic AI topology workspace with the canonical corpus structure, manifest, config schema, and OPA policies.

package/rulesets/topologies/agentic-ai/evidence.es.md

@@ -0,0 +1,25 @@
+# Evidencia de Validacion de IA Agentica
+
+> **Navegacion bilingue:** [Version en ingles](./evidence.md)
+
+## Comandos Reproducibles
+
+Ejecuta estos comandos desde la raiz del repositorio:
+
+```bash
+node .harness/scripts/validate-topology-manifests.mjs
+node .harness/scripts/ci/04-check-bilingual-parity.mjs
+node .harness/scripts/ci/01-validate-docs.mjs
+npm test -- --runInBand architecture-rule.handler.spec.ts
+```
+
+## Evidencia Esperada
+
+El fixture valido satisface el contrato y AAI-R01 a AAI-R07. El fixture invalido es rechazado intencionalmente por el schema de configuracion y representa fallos bloqueantes de sandbox, confianza, autorizacion, auditoria y limites de recursos. Las pruebas del evaluador Native incluyen casos que pasan y bloqueantes; la politica Rego correspondiente debe producir la misma disposicion para la misma entrada normalizada.
+
+## Limite de Evidencia
+
+Este archivo documenta validacion reproducible de topologia. No es un registro de cierre GT ni reemplaza la evidencia canonica de gobernanza requerida antes de marcar un gap como terminado.
+
+---
+[Volver al Perfil de IA Agentica](./README.es.md)

package/rulesets/topologies/agentic-ai/evidence.md

@@ -0,0 +1,25 @@
+# Agentic AI Validation Evidence
+
+> **Bilingual Navigation:** [Version en Espanol](./evidence.es.md)
+
+## Reproducible Commands
+
+Run these commands from the repository root:
+
+```bash
+node .harness/scripts/validate-topology-manifests.mjs
+node .harness/scripts/ci/04-check-bilingual-parity.mjs
+node .harness/scripts/ci/01-validate-docs.mjs
+npm test -- --runInBand architecture-rule.handler.spec.ts
+```
+
+## Expected Evidence
+
+The valid fixture satisfies the contract and AAI-R01 through AAI-R07. The invalid fixture is intentionally rejected by the configuration schema and represents blocking sandbox, trust, authorization, audit, and resource-limit failures. The Native evaluator tests include passing and blocking cases; the corresponding Rego policy must produce the same disposition for the same normalized input.
+
+## Evidence Boundary
+
+This file documents reproducible topology validation. It is not a GT closure record and does not replace the canonical governance evidence required before a gap is marked done.
+
+---
+[Back to Agentic AI Profile](./README.md)

package/rulesets/topologies/agentic-ai/evolution.es.md

@@ -0,0 +1,26 @@
+# Guia de Evolucion de IA Agentica
+
+> **Navegacion bilingue:** [Version en ingles](./evolution.md)
+
+## Principio de Evolucion
+
+La IA agentica es transversal y no debe disolver la propiedad de bounded contexts. Mantén orquestacion, ensamblaje de prompts, aplicacion de politicas y enrutamiento de herramientas en shells transversales. Mantén comandos de negocio, invariantes y decisiones de persistencia dentro de sus bounded contexts propietarios mediante contratos de aplicacion existentes.
+
+## Evolucion de Capacidades
+
+Amplia una capacidad a la vez. Agregar una capacidad requiere contrato de herramienta declarado, fuentes de contexto clasificadas, revision de sandbox, diseno de autorizacion y aprobacion, validacion Native y OPA, pruebas positivas y negativas y evidencia operativa. Una capacidad mutativa nueva requiere ademas revision contra ADR-0083.
+
+## Preparacion para Extraccion
+
+No extraigas un servicio orientado a agentes solo porque exista un agente. Sigue los criterios de extraccion del eje progresivo: propiedad distinta, necesidad de despliegue independiente, contrato estable, observabilidad, contencion de fallos y costo operativo justificado. El servicio externo conserva el mismo gateway de herramientas, evidencia y limites de dominio.
+
+## Retiro
+
+Retira una capacidad revocando su delegacion, eliminando su ruta de herramienta, reteniendo su evidencia requerida segun la politica gobernante y actualizando contrato, pruebas, reglas y runbook operativo juntos. No dejes herramientas inactivas alcanzables mediante una identidad general de agente.
+
+## Disparadores de Reevaluacion
+
+Reevalua esta topologia cuando cambie un modelo, herramienta, fuente de contexto, limite de despliegue, clasificacion de datos o metodo de aprobacion; cuando aumente la tendencia de denegaciones o fallos de politica; o cuando un patron satelite pueda ameritar promocion a un estandar reutilizable de Evolith.
+
+---
+[Volver al Perfil de IA Agentica](./README.es.md)

package/rulesets/topologies/agentic-ai/evolution.md

@@ -0,0 +1,26 @@
+# Agentic AI Evolution Guide
+
+> **Bilingual Navigation:** [Version en Espanol](./evolution.es.md)
+
+## Evolution Principle
+
+Agentic AI is cross-cutting and must not dissolve bounded-context ownership. Keep orchestration, prompt assembly, policy enforcement, and tool routing in cross-cutting shells. Keep business commands, invariants, and persistence decisions within their owning bounded contexts using existing application contracts.
+
+## Capability Evolution
+
+Expand one capability at a time. A capability addition requires a declared tool contract, classified context sources, sandbox review, authorization and approval design, Native and OPA validation, positive and negative tests, and operational evidence. A new mutative capability additionally requires review against ADR-0083.
+
+## Extraction Readiness
+
+Do not extract an agent-facing service merely because an agent exists. Follow the progressive-axis extraction criteria: distinct ownership, independent deployment need, stable contract, observability, failure containment, and justified operational cost. The external service retains the same tool gateway, evidence, and domain boundaries.
+
+## Deprecation
+
+Deprecate a capability by revoking its delegation, removing its tool route, retaining its required evidence according to the governing policy, and updating the contract, tests, rules, and operational runbook together. Do not leave dormant tools reachable through a general agent identity.
+
+## Reassessment Triggers
+
+Reassess this topology when a model, tool, context source, deployment boundary, data classification, or approval method changes; when denials or policy failures trend upward; or when a satellite pattern may merit promotion into a reusable Evolith standard.
+
+---
+[Back to Agentic AI Profile](./README.md)

package/rulesets/topologies/agentic-ai/fixtures/invalid-agent.config.json

@@ -0,0 +1,48 @@
+{
+  "agent": {
+    "id": "unsafe-reviewer",
+    "capabilities": ["write-production"]
+  },
+  "sandbox": {
+    "mode": "shared",
+    "network": "allowlist",
+    "process": "allowlist",
+    "ephemeral": false,
+    "maxDurationSeconds": 0,
+    "maxMemoryMb": 0,
+    "maxCpuCores": 0
+  },
+  "promptSources": ["src"],
+  "implementationRoots": ["src/agents"],
+  "contextPolicy": {
+    "untrustedContent": "authority",
+    "provenanceRequired": false,
+    "toolOutputSchemaValidation": false
+  },
+  "toolPolicy": {
+    "mutative": "auto-approve",
+    "capabilityDelegation": "unbounded"
+  },
+  "audit": {
+    "appendOnly": false,
+    "correlationId": "optional"
+  },
+  "operationalBudgets": {
+    "maxPromptTokens": 0,
+    "maxCompletionTokens": 0,
+    "maxContextWindowTokens": 0,
+    "mcpToolConcurrency": {
+      "maxInFlight": 0,
+      "perToolMaxInFlight": 0
+    },
+    "runbooksPath": ""
+  },
+  "credentialLifecycle": {
+    "delegationMaxTtlSeconds": 0,
+    "rotationCadenceDays": 0,
+    "revocation": {
+      "onIncident": "never",
+      "maxPropagationSeconds": 0
+    }
+  }
+}

package/rulesets/topologies/agentic-ai/fixtures/valid-agent.config.json

@@ -0,0 +1,48 @@
+{
+  "agent": {
+    "id": "architecture-reviewer",
+    "capabilities": ["read-architecture", "review-changes"]
+  },
+  "sandbox": {
+    "mode": "isolated",
+    "network": "allowlist",
+    "process": "deny",
+    "ephemeral": true,
+    "maxDurationSeconds": 30,
+    "maxMemoryMb": 512,
+    "maxCpuCores": 1
+  },
+  "promptSources": ["prompts"],
+  "implementationRoots": ["src/agents"],
+  "contextPolicy": {
+    "untrustedContent": "data-only",
+    "provenanceRequired": true,
+    "toolOutputSchemaValidation": true
+  },
+  "toolPolicy": {
+    "mutative": "approval-required",
+    "capabilityDelegation": "scoped-and-expiring"
+  },
+  "audit": {
+    "appendOnly": true,
+    "correlationId": "required"
+  },
+  "operationalBudgets": {
+    "maxPromptTokens": 16000,
+    "maxCompletionTokens": 4000,
+    "maxContextWindowTokens": 128000,
+    "mcpToolConcurrency": {
+      "maxInFlight": 4,
+      "perToolMaxInFlight": 2
+    },
+    "runbooksPath": "rulesets/topologies/agentic-ai/runbooks.md"
+  },
+  "credentialLifecycle": {
+    "delegationMaxTtlSeconds": 900,
+    "rotationCadenceDays": 30,
+    "revocation": {
+      "onIncident": "immediate",
+      "maxPropagationSeconds": 60
+    }
+  }
+}

package/rulesets/topologies/agentic-ai/maturity.es.md

@@ -0,0 +1,33 @@
+# Guia de Adopcion, Operacion y Evolucion de IA Agentica
+
+> **Navegacion bilingue:** [Version en ingles](./maturity.md)
+
+## Adopcion
+
+Adopta solo cuando un agente necesite contexto gobernado y uso acotado de herramientas. Declara `agent.config.json`, valida con `evolith validate --topology agentic-ai` y comienza con capacidades de solo lectura.
+
+## Patrones y Anti-Patrones
+
+Usa ensamblaje explicito de contexto, herramientas acotadas por capacidad, ejecucion aislada y aprobacion para mutaciones. No incluyas credenciales en prompts, no trates texto recuperado como autoridad ni permitas que un agente llame directamente a un repositorio o base de datos.
+
+## Seguridad y Auditoria
+
+Aplica aislamiento de sandbox ADR-0081, limites de confianza ADR-0082 y autorizacion acotada por capacidad con evidencia correlacionada append-only ADR-0083. El contexto es dato hasta que procedencia y validacion de schema establezcan lo contrario.
+
+## Operacion y Resiliencia
+
+Configura recursos acotados, cancelacion y timeout, traza cada llamada de herramienta y conserva evidencia suficiente para reconstruir una decision de politica. El fallo de una herramienta, politica o ruta de aprobacion falla cerrado; nunca otorga una capacidad mas amplia.
+
+## Evolucion
+
+Mantén la orquestacion de agentes en shells transversales, preserva ownership de bounded contexts y extrae un servicio orientado a agentes solo cuando se cumplan los criterios normales de extraccion progresiva. Reevalua la topologia cuando las herramientas adquieran una capacidad mutativa nueva o un nuevo limite de confianza.
+
+## Lista de Validacion
+
+- `agent.config.json` satisface AAI-R01 a AAI-R07 en Native y OPA.
+- El perfil tiene ADRs aceptados, README bilingue y esta guia de madurez.
+- CLI, MCP y Core API exponen el manifiesto mediante el plano de control compartido de topologias.
+- Las pruebas incluyen un contrato valido y cada condicion negativa bloqueante.
+
+---
+[Volver al Perfil de IA Agentica](./README.es.md)

package/rulesets/topologies/agentic-ai/maturity.md

@@ -0,0 +1,33 @@
+# Agentic AI Adoption, Operations, and Evolution Guide
+
+> **Bilingual Navigation:** [Version en Espanol](./maturity.es.md)
+
+## Adoption
+
+Adopt only when an agent needs governed context and bounded tool use. Declare `agent.config.json`, validate with `evolith validate --topology agentic-ai`, and begin with read-only capabilities.
+
+## Patterns and Anti-Patterns
+
+Use explicit context assembly, capability-scoped tools, isolated execution, and approval for mutations. Do not embed credentials in prompts, treat retrieved text as authority, or let an agent call a repository or database directly.
+
+## Security and Audit
+
+Apply ADR-0081 sandbox isolation, ADR-0082 trust boundaries, and ADR-0083 capability-scoped authorization with append-only correlated evidence. Context is data until provenance and schema validation establish otherwise.
+
+## Operations and Resilience
+
+Set bounded execution resources, cancellation and timeout behavior, trace every tool call, and retain evidence sufficient to reconstruct a policy decision. Failure of a tool, policy, or approval path fails closed; it never grants a broader capability.
+
+## Evolution
+
+Keep agent orchestration in cross-cutting shells, preserve bounded-context ownership, and extract an agent-facing service only when the normal progressive extraction criteria are met. Reassess the topology whenever tools acquire a new mutative capability or a new trust boundary.
+
+## Validation Checklist
+
+- `agent.config.json` satisfies AAI-R01 through AAI-R07 in Native and OPA.
+- The profile has accepted ADRs, bilingual README and this maturity guide.
+- CLI, MCP, and Core API expose the manifest through the shared topology control plane.
+- Tests include a valid contract and each blocking negative condition.
+
+---
+[Back to Agentic AI Profile](./README.md)

package/rulesets/topologies/agentic-ai/mcp/mcp-manifest.json

@@ -0,0 +1,100 @@
+{
+  "protocolVersion": "2025-03-26",
+  "topologyId": "agentic-ai",
+  "description": "MCP interface for the Agentic AI topology. Provides tools for inspecting and validating agentic configuration, resources for manifest and ruleset access, and prompts for AI-governed implementation guidance.",
+  "capabilities": {
+    "tools": {},
+    "resources": {},
+    "prompts": {}
+  },
+  "tools": [
+    {
+      "name": "evolith-topology-inspect",
+      "description": "Inspect an Agentic AI topology configuration and return its parsed manifest, operational budgets, and corpus artifact references.",
+      "inputSchema": {
+        "type": "object",
+        "properties": {
+          "configPath": {
+            "type": "string",
+            "description": "Path to the agentic AI configuration file (agent.config.json)"
+          },
+          "includeBudgets": {
+            "type": "boolean",
+            "description": "Include operational budget details (token, credential rotation, sandbox timeout)"
+          }
+        },
+        "required": ["configPath"]
+      }
+    },
+    {
+      "name": "evolith-topology-validate",
+      "description": "Validate an Agentic AI configuration against the topology ruleset and OPA policies, returning pass/fail per gate.",
+      "inputSchema": {
+        "type": "object",
+        "properties": {
+          "configPath": {
+            "type": "string",
+            "description": "Path to the agentic AI configuration to validate"
+          },
+          "strictMode": {
+            "type": "boolean",
+            "description": "Fail on warnings, not just errors"
+          }
+        },
+        "required": ["configPath"]
+      }
+    },
+    {
+      "name": "evolith-ruleset-explain",
+      "description": "Explain why a specific Agentic AI ruleset rule applies to a given configuration, including the rule logic and evidence.",
+      "inputSchema": {
+        "type": "object",
+        "properties": {
+          "ruleId": {
+            "type": "string",
+            "description": "The rule ID to explain (e.g., AGT-001, AGT-002)"
+          },
+          "configPath": {
+            "type": "string",
+            "description": "Path to the configuration being evaluated"
+          }
+        },
+        "required": ["ruleId", "configPath"]
+      }
+    }
+  ],
+  "resources": [
+    {
+      "uri": "evolith://topologies/agentic-ai/manifest",
+      "name": "Agentic AI Topology Manifest",
+      "description": "Full topology manifest for Agentic AI, including metadata, artifact references, and corpus configuration.",
+      "mimeType": "application/json"
+    },
+    {
+      "uri": "evolith://topologies/agentic-ai/rulesets",
+      "name": "Agentic AI Rulesets",
+      "description": "All ruleset files for Agentic AI: native rules JSON, OPA Rego policies, and WASM bundle.",
+      "mimeType": "application/json"
+    },
+    {
+      "uri": "evolith://topologies/agentic-ai/mcp",
+      "name": "Agentic AI MCP Interface",
+      "description": "This MCP manifest file describing tools, resources, and prompts available for Agentic AI.",
+      "mimeType": "application/json"
+    }
+  ],
+  "prompts": [
+    {
+      "name": "topology-aware-implementation",
+      "description": "Guides AI-assisted implementation to respect Agentic AI topology constraints, agent isolation, and trust boundaries."
+    },
+    {
+      "name": "agentic-ai-governance-review",
+      "description": "Performs a governance review of an Agentic AI topology configuration against ADR-0081 (sandbox isolation), ADR-0082 (trust boundary), and ADR-0083 (action authorization)."
+    },
+    {
+      "name": "adr-impact-analysis",
+      "description": "Analyzes the impact of ADR changes on the Agentic AI topology, identifying affected rulesets, contracts, and operational budgets."
+    }
+  ]
+}